Patent AU-2016247167-A1 (AU)
Title: Security threat information analysis
Inventor: MODI SHIMON
IPC: G06F21/00
Filed: 2016-10-20
Abstract: A computer-implemented method including determining, by one or more computers in an analysis system, one or more intelligence types, categorizing, by at least one of the computers and for each dataset from multiple datasets that each include information about potential security threats, each subset of data for the respective dataset, the categorizing including identifying, by at least one of the computers and for each of the subsets of data in the respective dataset, an intelligence type that categorizes the subset of data, and associating, by at least one of the computers and for each of the subsets of data in the respective dataset, the subset of data with the corresponding intelligence type, determining, by at least one of the computers and for each of the categorized subsets, whether the respective subset does not include information about the same threat as a different subset, determining, by at least one of the computers, that a first subset from the categorized subsets does not include information about the same threat as a second different subset in response to determining whether the respective subset does not include information about the same threat as a different subset, determining, by at least one of the computers, that a third subset from the categorized subsets includes information about the same threat as a fourth different subset in response to determining whether the respective subset does not include information about the same threat as a different subset, determining, by at least one of the computers, a group of the subsets that include particular data a third party system should receive from the analysis system, including determining, for a first third party system, a first group includes the first subset, and determining, for a second third party system, a second group that includes the third subset and does not include the fourth subset, assigning, by at least one of the computers and for each subset in each of the groups, a priority to the respective subset, and sending, by at least one of the computers and to a third party system, the subsets in the group of the subsets using the respective priorities including sending, to the first third party system, the subsets in the first group, including the first subset, using the respective priorities, and sending, to the second third party system, the subsets in the second group, including the third subset, using the respective priorities. Page 1 of 7 100 Proprietary Threat Open Sources Exchange Source 102a 102b Data102c Data sources T, <Receive data 104a4 104b T2 Intelligence Intelligence Parse data Type X Intelligence Type Y Type Y Determine 104a whether some T3 104b - of the parsed T< Th data is related Threat A to the same threat Data Construct m Data Construct n diMerge,or T4 relate data 106a 106b for the same threat Third Party A Third Party B Identify Third T5 Rule 1a Rule lb for security Rule 2a 108a 108b threat -- i -- information Data Construct Data Construct Send security T6 m 106a n 106b threat TYs- information to Third Party A Third Party B Third Parties 11Qa 110b|